wiki:TraceTop

Version 1 (modified by salcock, 10 years ago) (diff)

--

tracetop shows a live update of the busiest flows over time, performing a similar function to the 'top' tool in Unix.

Usage

tracetop
     [ -f exp, --filter=exp ]
     [ -s len, --snaplen=len ]
     [ -p mode, --promisc=mode ]
     [ --bits-per-sec ]
     [ --percent ]
     [ -i secs, --interval=secs ]
     inputURI [inputURI ...]

Options

-f, --filter
Apply a BPF filter to the input trace(s).
-s, --snaplen
Snap captured packets to the given length.
-p, --promisc
If 1, enable promiscuous mode on the input (if supported). If 0, disable promiscuous mode.
--bits-per-sec
Display flow bandwidth as bits per second.
--percent
Display flow bytes and packets as a percentage of total traffic.
-i, --interval
Wait this many seconds between updates. Defaults to 2 seconds.

Applications

Monitoring a live network to pick out large flows

tracetop -p 1 --percent --bits-per-sec int:eth0

Notes

  • If tracetop is run against a trace file, it will operate in trace time (i.e. preserving all timing gaps that were between the packets when they were originally captured).
  • tracetop is a nice way to get a quick look at how your network is performing and what might be using up all your bandwidth.